Security notice, updated October 23, 2026
PHP2Shell puts every WordPress site at risk. A static Next.js rebuild takes PHP out of the picture.
On October 21, 2026 the PHP project shipped emergency releases for two critical remote code execution bugs, together known as PHP2Shell. An attacker needs no password: a single crafted request to a vulnerable server can run code before WordPress, or any security plugin, ever loads. Exploitation was seen in the wild before the fix was public.
Tracked as CVE-2026-109618 and CVE-2026-109619. Disclosed by the PHP project on October 21, 2026. Sources are linked at the end of this page.
What happened
Why PHP2Shell is different from the usual WordPress alert
Most WordPress security news is about a plugin. This one is about the engine every WordPress site runs on.
Two bugs in the PHP engine itself
CVE-2026-109618 corrupts request data when PHP runs out of memory mid-request. CVE-2026-109619 lets internal state from one request leak into the next request handled by the same worker. Both end in remote code execution. Neither is a WordPress bug, which is why WordPress security plugins cannot see the attack.
No login required
The attacker does not need a WordPress account, an admin password, or a vulnerable plugin. The request is handled by PHP before the application starts, so the usual defenses (strong passwords, two-factor login, Wordfence, Solid Security) are bypassed.
Every PHP web install is in scope
PHP lists PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP as affected, and says no configuration change fully mitigates the bugs. Sites running Apache with mod_php are rated the highest risk because the attack lands before any application code runs.
Already being exploited
Amazon Threat Intelligence recorded an exploitation attempt against its honeypots on October 17, four days before disclosure. watchTowr has observed exploitation in the wild since the public release on October 21. Searchlight Cyber has published an open-source scanner that attackers and defenders alike can run.
Older PHP has no patch at all
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and earlier are out of support and received only minimal source backports; PHP 7.3 and older, including PHP 5, have no fix. Many small-business hosts and older plugins still pin sites to those versions.
The UK NCSC says take unpatchable systems offline
That is the official guidance for any PHP system that cannot be updated right away. For a business whose website is its storefront, that is not a workable option.
Why this keeps happening to WordPress
A patched server is still a server you have to keep patching
WordPress runs on PHP, full stop
Every WordPress page load executes PHP on a server you have to keep patched forever. A rebuilt Next.js site is pre-rendered into plain HTML and served from a CDN. There is no PHP engine on the server that answers your visitors, so a PHP bug has nothing to run on.
The legacy trap
Patching PHP today fixes PHP2Shell. It does not fix the next one, and it does nothing if a theme or plugin you depend on breaks on the patched version and your host rolls you back. Sites get stuck on old PHP for exactly that reason.
Plugins defend the house, not the foundation
Security plugins run inside WordPress. PHP2Shell runs underneath WordPress. A plugin cannot block a request that is executed before the plugin exists.
A smaller target, by design
A static site has no database connection, no admin login on the public server, and no server-side code running on each page load. That is not the same as "unhackable", nothing is, but it removes the entire category of server-side PHP exploits, not just this one.
Side by side
WordPress on PHP versus a static Next.js rebuild
| What we compare | WordPress on PHP | Static Next.js (ResultsXL rebuild) |
|---|---|---|
| PHP2Shell exposure | Vulnerable until the host patches PHP | Not applicable: no PHP engine serves the site |
| Public attack surface | PHP runtime, database, admin login, every plugin | Pre-rendered HTML, CSS, and JavaScript on a CDN |
| Who patches the server | You or your host, forever | No PHP server to patch; the platform maintains the edge |
| Worst case of a server bug | Full server takeover and data theft | No server-side PHP to take over |
| Security plugins needed | Yes, and they cannot see engine-level bugs | None |
What to do
Today, and then for good
Step one applies whether or not you ever talk to us. Steps two through four are how we get you off PHP.
- 01
Patch or isolate today
If you stay on WordPress for now: update PHP to a fixed release, restart every PHP worker, and put the site behind a WAF (Cloudflare has published rules for the known exploit paths, on the free plan too). If your host cannot update you, restrict public access until they can.
- 02
Scan your site, free
Our scanner reads your live site and sitemap, counts your pages, grades performance, SEO, schema, AI readiness, and mobile, and gives you an exact rebuild quote in about 30 seconds. No call required.
- 03
We rebuild it in Next.js, in 1–5 days
Every page and blog post is rebuilt as a pre-rendered Next.js 15 application, served from the Vercel edge network with no PHP and no public database. Every old URL is kept or redirected so you keep your rankings.
- 04
You own it
You get the GitHub repository, a signed Certificate of Ownership, and a 30-day support window. There is no PHP to patch next month, and no plugin treadmill.
FAQ
Questions business owners are asking this week
- Is my WordPress site definitely affected?
- If it runs on PHP older than 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or any 8.1 or older build without a vendor backport), yes. Ask your host which PHP version serves your site and whether PHP workers were restarted after the update. The vendor write-ups linked below include free checkers.
- If my host already patched PHP, do I still need to move?
- You are safe from these two bugs. The reason to move is the next one: WordPress will always need a patched PHP server, and your site is only as current as your host and your plugins allow. A static Next.js site removes that dependency entirely.
- Does a Next.js site make me unhackable?
- No, and anyone who says that is selling something. What it does is remove server-side PHP, the database connection, and the public admin login from the server your visitors hit, which is where WordPress breaches start. Forms, checkout, and the scanner on this site run as isolated serverless functions with no PHP involved.
- What happens to my content, blog, and rankings?
- Every page and post is rebuilt, not templated. Every old URL is kept or 301-redirected, schema markup is added to every page, and the finished site is measured against Lighthouse before launch. Our case studies publish the before and after scores.
- How fast can this happen?
- The scan and quote take about 30 seconds. A rebuild takes 1–5 days from payment to launch, depending on page count. Sites over 100 pages get a custom quote.
- What does it cost?
- Pricing is per page and shown on the pricing page, with three payment options. The scanner tells you your exact number before you talk to anyone.
Sources
Where these facts come from
Everything above about the vulnerabilities themselves comes from the PHP project and the security vendors below. We publish the links so you can check our reading of them.
- Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now! (2026-10-21)
- watchTowr Labs: PHP2Shell FAQ: CVE-2026-109618 and CVE-2026-109619 fixes (2026-10-22)
- Huntress: Rapid Response: php2shell, leaked critical PHP vulnerabilities (2026-10-21)
- Datadog Security Labs: PHP2Shell: detection, analysis, and remediation (2026-10-21)
- Qualys: PHP2Shell: find, mitigate, and patch now (2026-10-20)
Find out what your site runs on, free
The scan reads your live site, grades it, counts your pages, and gives you an exact Next.js rebuild quote in about 30 seconds.
No website yet? We build new sites from scratch